71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- release/*
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- release/*
|
|
# TODO (trask) adding this to the merge queue causes the merge queue to fail
|
|
# see related issues
|
|
# - https://github.com/github/codeql-action/issues/1572
|
|
# - https://github.com/github/codeql-action/issues/1537
|
|
# - https://github.com/github/codeql-action/issues/2691
|
|
# merge_group:
|
|
schedule:
|
|
- cron: "29 13 * * 2" # weekly at 13:29 UTC on Tuesday
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
permissions:
|
|
contents: read
|
|
actions: read # for github/codeql-action/init to get workflow details
|
|
security-events: write # for github/codeql-action/analyze to upload SARIF results
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: actions
|
|
- language: java
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Set up Java 17
|
|
if: matrix.language == 'java'
|
|
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
|
|
with:
|
|
distribution: temurin
|
|
java-version: 17
|
|
|
|
- name: Set up gradle
|
|
if: matrix.language == 'java'
|
|
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.9
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
# using "latest" helps to keep up with the latest Kotlin support
|
|
# see https://github.com/github/codeql-action/issues/1555#issuecomment-1452228433
|
|
tools: latest
|
|
|
|
- name: Assemble
|
|
if: matrix.language == 'java'
|
|
# --no-build-cache is required for codeql to analyze all modules
|
|
# --no-daemon is required for codeql to observe the compilation
|
|
# (see https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis#specifying-build-commands)
|
|
run: ./gradlew assemble --no-build-cache --no-daemon
|
|
|
|
- name: Perform CodeQL analysis
|
|
uses: github/codeql-action/analyze@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.9
|
|
with:
|
|
category: "/language:${{matrix.language}}"
|